Re: [sipcore] I-D Action: draft-ietf-sipcore-sip-token-authnz-02.txt

[Paul Kyzivat <[e-mail]>]

On 7/7/19 7:19 AM, Rifaat Shekh-Yusef wrote:
> All,
> 
> We have submitted a new version of the document based on the feedback 
> provided so far.
> Please, take a look at let us know what you think.

This is better. I still have a few thoughts:

* Regarding WWW-Authenticate:

I believe it will how be possible for a server to support both Digest 
and Bearer. I think this means that the client can use either depending 
on what sort of credentials it or its user happen to know.

I think it would be good to mention this. I guess in principle the 
client could return credentials for both. In that case, I don't know 
whether both must be valid or if it is sufficient for one to be valid. 
Perhaps we need to discuss that. (Presumably only credentials for a/the 
realm that the server supports are to be considered, with those for 
other realms being ignored.)

* Regarding non-registration requests (and maybe registration requests too):

    The UA MUST NOT insert a token in a non-REGISTER request, unless the
    non-REGISTER request has been challenged, or the peer is considered a
    trusted entity.

What is a trusted entity? In any case I think this is too strong. Once a 
request has been challenged the client knows this target wants the 
credentials. We certainly don't want to force every subsequent request 
to the same target to take two round trips, one without credentials and 
then one with. So the client needs to associate these credentials with 
this target, for awhile. But that begs the question of how long to 
retain this association. In the case of Digest, a nonce eventually 
expires and the old credentials fail and get forgotten and replaced by 
new ones. I guess the life cycle will be somewhat different for Bearer. 
This needs some thought and discussion.

	Thanks,
	Paul

> Regards,
>   Rifaat
> 
> 
> 
> On Sun, Jul 7, 2019 at 7:18 AM <[e-mail] 
> <mailto:[e-mail]>> wrote:
> 
> 
>     A New Internet-Draft is available from the on-line Internet-Drafts
>     directories.
>     This draft is a work item of the Session Initiation Protocol Core WG
>     of the IETF.
> 
>              Title           : Third-Party Token-based Authentication
>     and Authorization for Session Initiation Protocol (SIP)
>              Authors         : Rifaat Shekh-Yusef
>                                Christer Holmberg
>                                Victor Pascual
>              Filename        : draft-ietf-sipcore-sip-token-authnz-02.txt
>              Pages           : 12
>              Date            : 2019-07-07
> 
>     Abstract:
>         This document defines a mechanism for SIP, that is based on the
>     OAuth
>         2.0 and OpenID Connect Core 1.0 specifications, to enable the
>         delegation of the user authentication and SIP registration
>         authorization to a dedicated third-party entity that is separate
>     from
>         the SIP network elements that provide the SIP service.
> 
> 
>     The IETF datatracker status page for this draft is:
>     https://datatracker.ietf.org/doc/draft-ietf-sipcore-sip-token-authnz/
> 
>     There are also htmlized versions available at:
>     https://tools.ietf.org/html/draft-ietf-sipcore-sip-token-authnz-02
>     https://datatracker.ietf..org/doc/html/draft-ietf-sipcore-sip-token-authnz-02
>     <https://datatracker.ietf.org/doc/html/draft-ietf-sipcore-sip-token-authnz-02>
> 
>     A diff from the previous version is available at:
>     https://www.ietf.org/rfcdiff?url2=draft-ietf-sipcore-sip-token-authnz-02
> 
> 
>     Please note that it may take a couple of minutes from the time of
>     submission
>     until the htmlized version and diff are available at tools.ietf.org
>     <http://tools.ietf.org>.
> 
>     Internet-Drafts are also available by anonymous FTP at:
>     ftp://ftp.ietf.org/internet-drafts/
> 
>     _______________________________________________
>     sipcore mailing list
>     [e-mail] <mailto:[e-mail]>
>     https://www.ietf.org/mailman/listinfo/sipcore
> 
> 
> _______________________________________________
> sipcore mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/sipcore
>